Dashboards & Visualizations

Is there a bug with using $job.earliestTime$ token in the email subject when scheduling a dashboard object?

splunkcvc
New Member

Issue / Bug?

When scheduling a dashboard object using the $job.earliestTime$ in the email subject, it returns test_dashboard' 1969-12-31T19:00:01.000-05:00. (when epoch started...ish)

However, with other objects like report or saved search, the token $job.earliestTime$ works correctly and results with The scheduled report 'test_dashboard_test' has run. 2015-09-29T00:00:00.000-04:00

Is there a fix or workaround?
Otherwise a mailx script will have to do?

0 Karma

swmishra_splunk
Splunk Employee
Splunk Employee

$job.earliestTime$ and $job.latestTime$ are both job information tokens and they do not work with Dashboards Scheduled PDF Delivery.If you schedule a PDF Report it works but with Dashboards Job information tokens doesn't work.

The above tokens gives information about specific search jobs and a Dashboard is made up of multiple Reports which in turn has multiple searches.So it cannot extract specific search job information. Because of which we are getting some weird results.

The below document clearly states Job information tokens are not supported for Scheduled PDF Delivery for Dashboards.
http://docs.splunk.com/Documentation/Splunk/6.5.2/Viz/DashboardPDFs#Tokens_available_for_email_notif...

0 Karma

frobinson_splun
Splunk Employee
Splunk Employee

Hi @splunkcvc,
If you're scheduling a PDF delivery for a dashboard, then the job.earliestTime token is not supported. See this topic in our documentation to review which contexts (alert actions, PDF delivery, scheduled reports) support which tokens for email notification.
http://docs.splunk.com/Documentation/Splunk/6.1.3/Alert/Setupalertactions#Email_notification_context...

The token, as you observed, is only supported for reports and alert actions.

I hope this helps. Please let me know if you have other questions.

All best,
@frobinson_splunk

0 Karma

nehasharma57
New Member

As this is a known issue so do we have any workaround for this?

0 Karma

splunkcvc
New Member

yes,
I'm guessing the issue is because the dashboard with multiple time values , splunk does not know which value to choose from so it, outputs the 1st epoch time (1970).

0 Karma

splunkcvc
New Member

I'm using 6.1.4 and 6.2.5

0 Karma

frobinson_splun
Splunk Employee
Splunk Employee

Thanks, @splunkcvc. Are you seeing the same issue with both versions?

0 Karma

frobinson_splun
Splunk Employee
Splunk Employee

Hi @splunkcvc,
What version of the software are you using?
Thanks,
@frobinson_splunk

0 Karma

helenashton
Path Finder

Did you ever find out any more about this?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...